###################### Winlogbeat Configuration Example ##########################

# This file is an example configuration file highlighting only the most common
# options. The winlogbeat.full.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/winlogbeat/index.html

#======================= Winlogbeat specific options ==========================

# event_logs specifies a list of event logs to monitor as well as any
# accompanying options. The YAML data type of event_logs is a list of
# dictionaries.
#
# The supported keys are name (required), tags, fields, fields_under_root,
# forwarded, ignore_older, level, event_id, provider, and include_xml. Please
# visit the documentation for the complete details of each option.
# https://go.es.io/WinlogbeatConfig
winlogbeat.event_logs:
# Domain Controller
  - name: DFS Replication
    level: critical, error, warning
  - name: Directory Service
    level: critical, error, warning
  - name: DNS Server
    level: critical, error, warning
  - name: Microsoft-Windows-DFSN-Server/Admin
    level: critical, error, warning
# General
  - name: Application
    level: critical, error, warning
  - name: Security
    level: critical, error, warning
  - name: System
    level: critical, error, warning
  - name: WitnessClientAdmin
    level: critical, error, warning
  - name: WitnessServiceAdmin
    level: critical, error, warning
  - name: Microsoft-Windows-FailoverClustering/Diagnostic
    level: critical, error, warning
  - name: Microsoft-Windows-FailoverClustering/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-Config-Admin
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-High-Availability-Admin
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-Integration-Admin
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-VMMS-Admin
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-VMMS-Networking
    level: critical, error, warning
  - name: Microsoft-Windows-Hyper-V-VMMS-Storage
    level: critical, error, warning
  - name: Microsoft-Windows-Storage-Tiering/Admin
    level: critical, error, warning
# Data Protection Manager
  - name: DPM Alerts
    level: critical, error, warning
  - name: DPM Backup Events
    level: critical, error, warning
# Exchange
  - name: MSExchange Management
    level: critical, error, warning
  - name: Microsoft-Exchange-Troubleshooters/Operational
    level: critical, error, warning
  - name: Microsoft-Exchange-HighAvailability/Operational
    level: critical, error, warning
  - name: Microsoft-Exchange-HighAvailability/SeedingDebug
    level: critical, error, warning
# SolarWinds
  - name: SolarWinds.Net
    level: critical, error, warning
# SCOM
  - name: Operations Manager
    level: critical, error, warning
    event_id: -26008
# SMB
  - name: Microsoft-Windows-SMBServer/Connectivity
    level: critical, error, warning
  - name: Microsoft-Windows-SMBServer/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-SMBServer/Security
    level: critical, error, warning
  - name: Microsoft-Windows-SMBClient/Connectivity
    level: critical, error, warning
  - name: Microsoft-Windows-SMBClient/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-SMBClient/Security
    level: critical, error, warning
# Deduplication
  - name: Microsoft-Windows-Deduplication/Diagnostic
    level: critical, error, warning
  - name: Microsoft-Windows-Deduplication/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-Deduplication/Scrubbing
    level: critical, error, warning
# Remote Desktop Services
  - name: Microsoft-Windows-TerminalServices-Gateway/Admin
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-Gateway/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-SessionBroker/Admin
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-SessionBroker/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-SessionBroker-Client/Operational
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-TSV-VmHostAgent/Admin
    level: critical, error, warning
  - name: Microsoft-Windows-TerminalServices-TSV-VmHostAgent/Operational
    level: critical, error, warning
# WMI
  - name: Microsoft-Windows-WMI-Activity/Operational
    level: critical, error, warning
#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
fields_under_root: true
fields:
  environment: {$primaryEnvironmentName$}
  primarysystemname: {$primarySystemName$}
  clustername: {$clusterName$}
  rdsHostPrimaryCollectionName: {$rdsHostPrimaryCollectionName$}

#================================ Outputs =====================================

# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["{$elasticsearchHostName$}:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: critical, error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
